skatespots/SkateSpots
1
0
Fork 0
Code Issues Pull requests Projects Releases 11 Packages Wiki Activity Actions 1

chore(deps): run npm dedupe in the automated job

Browse source 
A minor bump can nest a duplicate transitive copy and break tsc type identity
(@tanstack/query-core, @nostrify/*). Dedupe after npm update before the test gate.
This commit is contained in:
SkateSpots 2026-10-26 11:27:51 +07:00
parent f8ec7e35c0
commit 77b3c23633
2 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
AGENTS.md
View file

@ -2304,6 +2304,8 @@ Rules:
replacing). Lesson: do NOT rely on a blanket `npm update`; update in curated replacing). Lesson: do NOT rely on a blanket `npm update`; update in curated
batches (pin `typescript`, add `overrides`/`npm dedupe` for the duplicated batches (pin `typescript`, add `overrides`/`npm dedupe` for the duplicated
packages, keep majors as their own migrations) and let the timer gate each. packages, keep majors as their own migrations) and let the timer gate each.
The job now also runs **`npm dedupe`** after `npm update` (to stop the duplicate
transitive copies that broke type identity).
✅ **Curated batch landed (2026-10-26):** pinned `typescript` **5.8.3 exact**, ✅ **Curated batch landed (2026-10-26):** pinned `typescript` **5.8.3 exact**,
updated `vite` **6.4.5**, `vitest` **3.2.7**, `@unhead/react`/`unhead` updated `vite` **6.4.5**, `vitest` **3.2.7**, `@unhead/react`/`unhead`
**2.1.17**, `yaml` **2.9.1**, then `npm dedupe` — `npm test` green and OSV **2.1.17**, `yaml` **2.9.1**, then `npm dedupe` — `npm test` green and OSV

5
scripts/update-deps.sh
View file

@ -91,8 +91,11 @@ cp package.json "$STATE_DIR/package.json.bak" 2>/dev/null || true
cp package-lock.json "$STATE_DIR/package-lock.json.bak" 2>/dev/null || true cp package-lock.json "$STATE_DIR/package-lock.json.bak" 2>/dev/null || true
# ── apply non-breaking updates ────────────────────────────────────────────── # ── apply non-breaking updates ──────────────────────────────────────────────
log "applying non-breaking updates (npm update + npm audit fix)…" log "applying non-breaking updates (npm update + npm dedupe + npm audit fix)…"
npm update 2>&1 | tail -3 npm update 2>&1 | tail -3
# Collapse duplicate transitive copies (e.g. @tanstack/query-core, @nostrify/*).
# Without this a minor bump can nest a second copy and break type identity in tsc.
npm dedupe 2>&1 | tail -2
npm audit fix 2>&1 | tail -3 npm audit fix 2>&1 | tail -3
{ {
echo; echo "=== post-update npm audit ==="; npm audit 2>&1 || true echo; echo "=== post-update npm audit ==="; npm audit 2>&1 || true